CVE-2022-45969 Alist vulnerable to Path Traversal

What is CVE-2022-45969?

CVE-2022-45969 is a critical path traversal vulnerability in n/a, published on 15 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Alist v3.4.0 is vulnerable to Directory Traversal,

Weakness: CWE-22

Which versions are affected by CVE-2022-45969?

4 open source packages ship an affected version, including github.com/alist-org/alist/v3 and github.com/alist-org/alist. It affects 1 product.

Products include Alistgo Alist.

How do I fix CVE-2022-45969?

Upgrade github.com/alist-org/alist/v3 to 3.6.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-45969 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-45969 exists.

Other vulnerabilities in n/a

• CVE-2026-25160 Alist has Insecure TLS Config Critical 9.1
• CVE-2026-25161 Alist vulnerable to Path Traversal in multiple file operation handlers High 8.8
• CVE-2023-33498 alist Incorrect Access Control vulnerability High 8.8
• CVE-2022-45968 AList vulnerable to Improper Preservation of Permissions High 8.8
• CVE-2023-31726 Missing authorization in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pmg2-rph8-p8r6, GO-2022-1171.